Presentation is loading. Please wait.

Presentation is loading. Please wait.

Forensics: Tripwire Project Report Conor Harris Parth Jagirdar Zheng Fang.

Similar presentations


Presentation on theme: "Forensics: Tripwire Project Report Conor Harris Parth Jagirdar Zheng Fang."— Presentation transcript:

1 Forensics: Tripwire Project Report Conor Harris Parth Jagirdar Zheng Fang

2 What We’ve Done Setup Tripwire ▫yum install tripwire ▫twadmin –m G –S./site.key ▫twadmin –m G –L./$HOSTNAME-local.key Configure Policy ▫Remove all “file/dir not exists” warnings ▫Change “scan the individual reports” to “yes” ▫Add rule: check ‘/’ recursively, mode=SEC_CRIT ▫Remove all rules that conflict with the added rule

3 What We’ve Done (Cont.) Initialize ▫twadmin --create-cfgfile –S site.key twcfg.txt ▫twadmin --create-polfile –S site.key twpol.txt ▫delete twcfg.txt and twpol.txt ▫chmod 0600 tw.cfg tw.pol ▫tripwire –init Backup ▫key, cfg, pol, database.

4 Alert Policy File is NOT Secure!!! ▫even if “twpol.txt” is deleted can be retrieved using “twadmin –print-polfile” without any password. Of course, we’ve got all the others’ policy file. And did a little analysis.

5 Damages Made on All Create /media/canyouseeme Create /lost+found/.history Change modification time of /etc/yp.conf "05:27:09 " Change file /var/log/maillog ▫change a "localhost" to "l0calhost" and keep the original modification time.

6 +Damage Made on Add 'cat' to /var/lib/tripwire/report/ twr chmod 777 /etc/X11 Installed Kate

7 +Damage Made on Add 'cat' to /var/lib/tripwire/report/ twr chmod 777 /etc/X11

8 +Damage Made on Change modificatoin time of /var/log/samba/old "05:27:09" Change a "session" to "s3ssion" in /var/log/secure and keep the original modification time Change "=" to "-" in /etc/xml/catalog

9 Changes Found on Our Machine All files in “/etc/tripwire” are gone ▫rm –f *.* “localhost.localdomain.twd” changed ▫add “forensics” “.bash_profile” changed ▫add “/tmp/ttyconsole&” Create shortcut./cdrom ▫ln -s /usr/bin/./cdrom Added a new user called “helpless” ▫useradd helpless

10 Changes Found on Our Machine (Cont.) Installed airsnort.i386 and all of its dependencies ▫yum install airsnort.i386 Changed permissions on etc directory to 757 ▫chmod 757 etc/ Made directory /root/.enlightenment Added file /root/.enlightenment/.IgnoreMe! ▫wrote the date to this file

11 Changes Found on Our Machine (Cont.) Installed lrk4 and all of its dependencies Added /var/tmp/... Added /var/tmp/.../.... Added/etc/... Added /etc/.../.... Added /tmp/... Added /tmp/.../.... Added /tmp/tty-console Added /tmp/.. Added /... Added /.../....

12 Changes Found on Our Machine (Cont.) Added: /home/... Added: /home/.../.... Added: /home/user1/... Added: /home/user1/.../.... Added: /var/lib/tripwire/report/... Added: /var/lib/tripwire/report/.../.... Added fake report: /var/lib/tripwire/report/localhost.localdomain twr Added fake report: /var/lib/tripwire/report/.localhost.localdomain twr

13 Changes Found on Our Machine (Cont.) Added: /root/.tmp Added: /root/d Threw “lrk4.src.tar.gz” into Trash Added: /root/d Deleted: /var/lock/subsys/sendmail

14 Other Changes Installation of programs also modified system logs and configuration files. Create new user also automatically generate a list of files by system. Using gnome environment (Firefox, etc.) created and modified lots of log and configuration files, leaving some stuff in the cache.


Download ppt "Forensics: Tripwire Project Report Conor Harris Parth Jagirdar Zheng Fang."

Similar presentations


Ads by Google